Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Prefer not to run the server on your own PC? Godlike.Host offers hosted Hytale servers with free DDoS protection and up to three free backups a day.
Authenticate a Hytale server by starting HytaleServer.jar, running /auth login device, and completing the one-time device authorization in a browser. For unattended or multi-server deployments, use Hytale’s OAuth 2.0 device flow to obtain a sessionToken and identityToken, then pass them to the server at startup or through environment variables. Authentication is required before the server can accept players and communicate with Hytale service APIs.
What Hytale server authentication does
Authentication proves that a server is operating for an authorized Hytale account and profile. Hypixel Studios states that “Hytale Servers require authentication to enable communication with our service APIs and to counter abuse.” The same manual says, “Once authenticated, your server can accept player connections.” In practical terms, an unauthenticated process may start, but it is not ready to provide the normal multiplayer service until valid credentials are available.
Free tools Windows power users keep installed
One-click scans. No signup required.
The credentials used by the running server are a short-lived game-session token and an identity token. The game-session token authorizes the active server session; the identity token identifies the selected game profile. Hytale’s provider documentation describes obtaining both through OAuth 2.0 and then supplying them to the server.
Before you begin
- Use Java 25, which the dedicated-server manual lists as a requirement.
- Provide at least 4 GB of memory for the dedicated server.
- Have access to the Hytale account that owns the game license and the profile you want the server to use.
- For interactive login, have a browser available on any device that can open the displayed verification URL. The browser does not have to run on the server itself.
- For unattended operation, decide how your deployment will protect and persist OAuth and server credentials before placing tokens in startup configuration.
The provider guide also sets an account-level capacity limit: one Hytale game license may have up to 500 concurrent server sessions. If your deployment needs more, an additional game license is required.
#1 Best Overall
- Compatible with Windows and Android.
- 1000Hz Polling Rate (for 2.4G and wired connection)
- Hall Effect joysticks and Hall triggers. Wear-resistant metal joystick rings.
- Extra R4/L4 bumpers. Custom button mapping without using software. Turbo function.
- Refined bumpers and D-pad. Light but tactile.
Interactive authentication for one server
The device-login command is the simplest method for a first installation or a server managed by a person at the console. It uses a short-lived code rather than asking you to paste a password into the server terminal.
1. Put the server JAR in a clean directory
For a standard installation, place HytaleServer.jar in an empty directory. Keeping the bootstrap files separate from unrelated files makes the generated server layout and its credential files easier to secure and back up.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match2. Launch bootstrap mode
Start the JAR in its bootstrap mode using the launch method supplied with your Hytale server package. Wait for the server console to become available for commands. The first run is the point at which you authenticate and prepare the installed server files.
3. Request a device login
At the server console, enter:
/auth login device
The console prints a device URL and a one-time code. The code is intended for this authorization attempt; do not reuse an old code from a previous run.
Rank #2
- Supported Multi-Platform:Switch/Switch 2 (NO support wake-up function)/iOS/Android/Windows PC (Notice:Not compatible with Xbox, PlayStation or GeForce Now, For game platforms not mentioned, please consult customer service before buying）
- Connection modes:Wired/Bluetooth/Wireless Dongle(Connect to PC via Bluetooth : Select iOS (phone) mode, but it's not recommended; Dongle is more stable)
- 【Innovative Intelligent Interactive Screen】Manba One V2 wireless game controllers create a new era of controller screens; Equipped with a 2-inch display, no App & software needed, you can set the pc controller directly through the screen visualization, More convenient operation
- 【Micro Switch Button】Manba One wireless controller has Micro Switch Button and ALPS Bumper; The 6-axis gyroscope function makes switch games more immersive
- 【Customize Your Own Controller】The intelligent interactive screen allows you to easily set vibrations, buttons, joysticks,lights, etc., without the need for complex key combinations; 4 configurations can be saved to unlock your own gameplay for different games; The 4 back keys support macro definition settings, and you can activate the set character's ultimate move with one click
4. Authorize in a browser
- Open the device URL shown by the console.
- Enter the one-time code exactly as displayed.
- Sign in to the Hytale account that should own the server session.
- Approve the authorization request and, if prompted, select the game profile for this server.
Return to the console and wait for the login operation to complete. Do not terminate the process while it is polling for approval. The provider guide shows a 900-second device-authorization expiry as an example; if the code expires before approval, request a new device login and repeat the browser steps.
5. Install the server files
After bootstrap authentication, run /update setup (or /update download) as directed by the official server manual. The bootstrap credentials are carried into the installed server layout, so you do not normally need to perform a separate browser login immediately after setup.
6. Start the generated launcher
Use the launcher generated by setup: start.sh on Linux or other Unix-like systems, and start.bat on Windows. Starting the generated launcher rather than repeatedly invoking the bootstrap JAR preserves the installed layout and its authentication configuration.
Headless authentication for automation
A headless server has no convenient browser or operator at its console. Hytale’s provider guide documents an OAuth 2.0 implementation using the RFC 8628 device-authorization grant. Your provisioning or control service performs the browser-assisted portion once, stores the resulting refresh credentials securely, and supplies fresh server credentials whenever a process starts.
Rank #3
- Tri-mode Connectivity: Wired for Xbox, 2.4G & Wired for PC, and Bluetooth for Android. The G7 Pro supports seamless connectivity across Xbox, PC, and Android. Effortlessly switch between modes using the convenient physical mode switch.
- TMR Sticks: The G7 Pro features GameSir's Mag-Res TMR sticks, combining Hall Effect durability with traditional potentiometer performance. This advanced technology delivers stable polling rates for smooth, drift-free gaming with low power consumption.
- Hall Effect Analog Triggers: The GameSir precision-tuned Hall Effect analog triggers provide unmatched smoothness and linear input for precise control. Featuring clicky Micro Switch trigger stops, gamers can easily switch based on their preferences.
- 1000Hz Polling Rate on PC: Experience ultra-responsive gaming with a 1000Hz polling rate on PC, available through both wired and 2.4G wireless connections. This ensures instantaneous input registration, reducing lag and optimizing your performance for the most competitive gameplay.
- GameSir Nexus App: The G7 Pro is compatible with the upgraded GameSir Nexus app, which brings a significant upgrade over the original. It introduces powerful new features such as gyro settings, stick curve adjustments, and button-to-mouse mapping, giving you deeper customization and more control than ever before.
The OAuth device flow
- Request a device code. Your provider requests a device authorization from Hytale’s OAuth service.
- Display the verification details. Show the verification URL and user code to an operator. The operator can complete this step from a separate workstation.
- Poll the token endpoint. Continue polling until the operator approves the request, the request expires, or the provider returns an error. Respect the interval and error responses supplied by the OAuth service instead of creating a tight polling loop.
- Retrieve available game profiles. After OAuth authorization succeeds, query the profiles available to the account.
- Select a profile. Choose the profile that should own the server session and retain its UUID with the credential record.
- Create a game session. Call the game-session endpoint for the selected profile.
- Receive server credentials. The response supplies a
sessionTokenand anidentityToken. These are the values consumed by the server process.
This flow separates human consent from server operation: a person authorizes the account once, while the running service uses tokens and refresh logic thereafter.
Pass tokens as command-line options
A provider can inject credentials when launching the server with:
java -jar HytaleServer.jar
--session-token "<sessionToken>"
--identity-token "<identityToken>"
--owner-uuid "<profile-uuid>"Replace each angle-bracketed value with the token or profile UUID returned by the authorization flow. Keep the command readable only to the service account that starts the process; command-line arguments can be exposed by process inspection or diagnostic tooling on some operating systems.
Pass tokens through environment variables
Instead of putting secrets in the process arguments, set:
Rank #4
- Multi-Platform PC Gaming Controller: Working with Switch, PC, Android, and iOS devices via Bluetooth, wired, and wireless dongle connections.
- Hall Effect Joysticks: Delivering enhanced recentering performance for smoother control and superior anti-drift capability. Plus, with anti-friction rings.
- 2-Way Trigger Lock: With trigger stops, gamers can toggle between short and long pull positions. Additionally, gamers can activate hair trigger mode by pressing M+LT/RT (triggers must be in the long pull position).
- 1000Hz Polling Rate: This ensures that your inputs are registered almost instantaneously, minimizing lag and maximizing your performance during competitive play.
- Mechanical Circular D-pad: Designed for quick reactions and accuracy in every direction, this D-pad elevates your gaming experience with superior responsiveness.
HYTALE_SERVER_SESSION_TOKEN=<sessionToken>
HYTALE_SERVER_IDENTITY_TOKEN=<identityToken>Then launch the JAR normally through your service manager or container entrypoint. Environment variables avoid placing the values directly in a shell history or unit-file argument list, but they are still secrets: restrict access to the process environment, deployment configuration, logs, and crash reports.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsToken lifetime, refresh, and restarts
Authentication is not a one-time permanent password. The provider documentation describes two linked lifecycles:
| Credential or event | Documented behavior | Operational consequence |
|---|---|---|
| Game-session token | Valid for 1 hour | The running server must refresh its game session before expiry. |
| Automatic session refresh | Attempted 5 minutes before expiry | A healthy online server normally renews before the one-hour limit. |
| OAuth refresh token | Lasts 30 days when unused | A server that remains offline longer than this period needs a new login. |
| Refresh-token rotation | A new refresh token is returned on every use | Persist the newly returned token and replace the previous value immediately. |
| Device authorization example | 900-second expiry shown in the provider guide | Complete browser approval before the displayed authorization window closes. |
When a session refresh fails, the server can fall back to OAuth refresh and create a new game session. That fallback only works if the stored OAuth refresh token is still valid and the replacement token is saved. If your automation discards the new refresh token, a later restart may require an interactive login even though the first refresh appeared to succeed.
Why a restart can appear to “lose” authentication
- The server was offline too long. An unused OAuth refresh token is documented for 30 days; beyond that period, perform a new device login.
- Rotation was not persisted. Every refresh returns a replacement refresh token. Update the secret store transactionally so a crash cannot leave only the already-used token.
- Only the game-session token was saved. A one-hour session token is not a durable credential for future restarts. Keep the OAuth refresh data and selected profile as well.
- The profile changed. If the deployment starts with a different owner UUID than the one authorized, obtain a game session for the intended profile and pass that UUID consistently.
- Startup injection is missing. Verify that the service manager, container, or generated launcher actually receives both required token variables or command-line options.
Persisting credentials safely
For a single manually managed server, the bootstrap process carries authentication into the installed layout. Protect that directory as you would any other credential store: limit filesystem permissions, avoid sharing archives containing its files, and keep secrets out of public logs and source-control repositories.
Best Value
- Platform Compatibility: This PC controller is designed for Windows PC, Steam, Switch, Android, and iOS. Xbox-style asymmetric stick layout for PC gamers. Three modes cover all your devices. Please check your device compatibility before purchase
- Three Connection Modes: 2.4G wireless, Bluetooth, wired USB-C. PC gets native XInput/DirectInput. Switch pairs via Bluetooth, no adapter. This gaming PC controller switches devices seamlessly. Stable wireless minimizes random disconnects during gaming
- Hall Effect Precision: Hall effect joysticks and triggers eliminate stick drift. This gaming controller for PC delivers smooth, responsive input with no dead zones. Built for FPS, racing, and action games. Long-term precision for competitive PC gaming
- Back Buttons & Battery: Two programmable back buttons map combos and shortcuts. Textured grips with dual vibration. 1000mAh battery delivers up to 20H playtime. RGB can be turned off. A solid PC controller for gaming with custom back buttons
- ABXY Layout Switch: Press B + Minus + Plus to swap between PC and Switch modes. Features: 1000Hz polling rate, RGB lighting, turbo. Note: designed without mic jack or gyro sensor
For provider-managed or plugin-based deployments, the guide defines an IAuthCredentialStore interface. Register the store before authentication occurs. The server then uses it to retrieve credentials and persist refreshed OAuth tokens and the selected profile. Registering it afterward cannot recover credentials that were already issued to an earlier authentication attempt.
Recommended persistence properties
- Atomic replacement: write the newly rotated refresh token without destroying the last known-good record if the process stops mid-write.
- Access control: allow only the server account and the credential-management component to read the store.
- Profile binding: store the selected profile UUID beside the OAuth data so a restart requests a session for the same profile.
- Redaction: never print access, identity, session, or refresh tokens in normal logs or error messages.
- Backup discipline: encrypt backups and remember that restoring an old refresh token may fail after the newer token has rotated.
Choosing an authentication approach
| Situation | Best-fit method | Why | Main caution |
|---|---|---|---|
| One administrator setting up one server | /auth login device |
Fast, interactive, and supported directly by the server console. | A browser approval is required whenever a new login is needed. |
| Dedicated machine with no desktop session | OAuth device flow plus startup token injection | The operator authorizes from another device; the server runs unattended. | Protect environment variables or arguments and implement refresh handling. |
| Many servers or dynamic instances | Provider service with IAuthCredentialStore |
Centralizes profile selection, token rotation, and persistence. | Register the store before authentication and enforce strict secret access. |
| Long shutdowns or disaster recovery | Persist OAuth refresh credentials and plan re-login | Allows a restart to create a new game session instead of relying on an expired one-hour token. | Offline periods beyond 30 days require a new login. |
Scale planning must include the license limit: 500 concurrent server sessions per Hytale game license. Authentication automation can simplify provisioning, but it does not remove that account-level capacity boundary.
Troubleshooting checklist
The command is rejected or produces no URL
- Confirm that you are entering
/auth login devicein the Hytale server console, not in a shell prompt. - Check that the bootstrap JAR is the process currently running and that its console is ready to accept commands.
- Start a fresh device authorization rather than attempting to reuse an old code.
The browser says the code is invalid or expired
- Copy the newly printed code exactly; do not include a previous run’s code.
- Complete approval within the authorization window. The provider guide’s example is 900 seconds.
- Request another device code if the window has elapsed, then restart the browser step.
The browser approves, but players still cannot connect
- Wait for the console to report that authentication completed.
- Ensure you ran
/update setupor/update downloadand then started the generatedstart.shorstart.bat. - For headless startup, verify that both the session and identity tokens are present and that
--owner-uuididentifies the authorized profile. - Check that the server process has network access to the Hytale services required for authentication and session refresh.
The server works for about an hour, then authentication fails
- Investigate the automatic refresh that should run five minutes before the one-hour game-session expiry.
- Confirm that the process can reach the token and game-session services at refresh time.
- Verify that OAuth refresh data exists and that each rotated refresh token is persisted.
A long-offline server will not restart
If it has been offline longer than the documented 30-day unused refresh-token lifetime, the stored OAuth credential is no longer sufficient. Perform a new device authorization, obtain a new profile session, and update the credential store used by the service.
Quick Recap
Security and operations checklist
- Run the server with Java 25 and at least 4 GB of memory.
- Use the device command for initial human authorization; do not place account passwords in scripts.
- For automation, keep the session token, identity token, refresh token, and profile UUID in a restricted secret store.
- Prefer a credential store or protected environment injection over hard-coding secrets in images and repositories.
- Monitor session refresh events without logging token values.
- Persist every rotated refresh token before treating a refresh as successful.
- Document which Hytale profile UUID belongs to each server.
- Plan for reauthentication after more than 30 days offline.
- Count concurrent sessions against the 500-per-license limit before scaling out.
Quick reference
| Task | Command or setting |
|---|---|
| Start device authorization | /auth login device |
| Prepare installed server files | /update setup or /update download |
| Generated Unix launcher | start.sh |
| Generated Windows launcher | start.bat |
| CLI session credential | --session-token "<sessionToken>" |
| CLI identity credential | --identity-token "<identityToken>" |
| CLI profile binding | --owner-uuid "<profile-uuid>" |
| Environment session credential | HYTALE_SERVER_SESSION_TOKEN |
| Environment identity credential | HYTALE_SERVER_IDENTITY_TOKEN |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
